What is the CVSS score of CVE-2026-32931?

CVE-2026-32931 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-32931?

Chamilo LMS versions before 1.11.38 and 2.0.0-RC.3 contain a critical file upload vulnerability that allows authenticated teachers to execute arbitrary code on the server by uploading PHP webshells…. A patch is available.

How to fix or mitigate CVE-2026-32931?

Within 24 hours: Inventory all Chamilo LMS deployments and identify current versions. Within 7 days: Apply vendor patch-upgrade to Chamilo 1.11.38 or 2.0.0-RC.3 (or later stable release). Within 30 days: Conduct file system audit of web-accessible upload directories for suspicious .php files with audio MIME types; review teacher account activity logs from deployment date to patch date for unauthorized exercise uploads.

PHP CVE-2026-32931

EUVD-2026-21531 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-10 security-advisories@github.com

RCE PHP File Upload

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 21:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:58 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.11.38,2.0.0-RC.3

EUVD ID Assigned

Apr 10, 2026 - 18:22 euvd

EUVD-2026-21531

Analysis Generated

Apr 10, 2026 - 18:22 vuln.today

CVE Published

Apr 10, 2026 - 18:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file upload vulnerability in the exercise sound upload function allows an authenticated teacher to upload a PHP webshell by spoofing the Content-Type header to audio/mpeg. The uploaded file retains its original .php extension and is placed in a web-accessible directory, enabling Remote Code Execution as the web server user (www-data). This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

AnalysisAI

Remote code execution in Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3 allows authenticated teachers to upload PHP webshells through the exercise sound upload function by spoofing Content-Type headers to audio/mpeg. Uploaded malicious files retain their .php extensions and execute in web-accessible directories with web server privileges (www-data). Attack requires low-privilege teacher account but no user interaction. No public exploit identified at time of analysis.

Technical ContextAI

CWE-434 unrestricted file upload flaw in exercise audio attachment handler. Server-side validation relies solely on client-controlled Content-Type header without verifying actual file content or enforcing extension allowlists. Uploaded files bypass sanitization, preserving executable .php extensions in publicly accessible upload directories, enabling direct server-side script execution.

RemediationAI

Vendor-released patches: upgrade to Chamilo LMS version 1.11.38 (stable) or 2.0.0-RC.3 (release candidate) immediately. Patches implement server-side MIME type validation, file extension filtering, and safe file handling per commits 8cbe660de267f2b6ed625433bdfcf38dee8752b4 and d5ef5153df3d1b2de112cbeb190cdd10bea457f3. Until patching, disable exercise sound upload functionality in teacher role permissions and audit existing upload directories (/main/default_course_document/audio/) for suspicious .php files. Review teacher account access; restrict to trusted users only. Official advisory: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-863j-h6pf-3xhx. No workarounds fully mitigate risk without upgrade.